OIDC Authentication, and Cloud CLI Contexts #1082

nickmisasi · 2024-10-09T19:07:01Z

Summary

This PR introduces 2 major features

OIDC Authentication.

Defaulted to off, unless the server is provided with a Client ID, Secret, and Organization URL.
Setting the aforementioned parameters will result in the provisioner validating requests to /api/* contain a valid Access Token from Azure AD.
Authentication for CLI's is handled using Device Authorization grants, via cloud login command. Authentication data (access tokens, refresh tokens, etc) are stored in a context

Screenshots:
Login page of Azure AD (Browser auto-opens)

Logs in terminal when initiated:

CLI Contexts

Most users have their own custom hacks or bash scripts to automate the passing of --server to handle interacting with different environments. This PR introduces the concept of contexts, stored in ~/.cloud/contexts.json

Contexts store:

Server URL
Auth Data (like your access and refresh tokens)
An alias (for switching)
Client ID, and Org URL to kick off authorization flow (if configured)

A new CLI option now exists cloud contexts <command> with the following options:

Manipulate local contexts for the Cloud CLI

Usage:
  cloud contexts [command]

Available Commands:
  create      Create a new context.
  delete      Delete a context.
  get         Get details of a specific context.
  list        List all contexts.
  set-current Set the current context.
  update      Update a context.

Additionally, a cloud login command has been added, which allows you to retrigger the login flow for a particular context, should you run into authentication issues.

cloud login --help
Login to the Mattermost Cloud provisioning server.

Usage:
  cloud login [flags]

Flags:
      --context string   The name of the context to use.
  -h, --help             help for login

The --server parameter has been removed. Instead, use cloud context create to create a context for each Provisioner environment you interact with. To switch between them, use cloud context set-current. All cloud commands will initiate based off of the currently set context (todo: support --context to switch contexts for a single command)

On first run of the Cloud CLI with this change, the contexts.json file will be created for you, containing one context with alias local pointing at http://localhost:8075.

When creating a new context, if you provide a Client ID and OrgURL, the CLI will automatically initiate the login flow for you. To skip the authentication flow, pass the argument --skip-auth

Ticket Link

https://mattermost.atlassian.net/browse/CLD-8406

Release Note

Support for validating OAuth JWT tokens for authentication purposes
Addition of `contexts` command, to enable creating, saving, and switching between different provisioner environments

mm-cloud-bot · 2024-10-09T19:07:04Z

@nickmisasi: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

I understand the commands that are listed here

…llow list for said clients

nickmisasi · 2024-10-25T17:36:10Z

internal/auth/device_authorization.go

+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"


Borrowed the OAuth2 built in types for some marshaling, but couldn't use it for token exchange here as MS requires a custom scope to be passed, and this library doesn't support doing that when using refresh tokens

esarafianou

First round of comments, but I'll re-review this.

internal/auth/device_authorization.go

cmd/cloud/contexts.go

cmd/cloud/main.go

esarafianou · 2024-11-12T12:13:32Z

internal/auth/cli.go

+	newToken, err := Refresh(ctx, config, auth.RefreshToken)
+	if err != nil {
+		return nil, err
+	}
+
+	auth.AccessToken = newToken.AccessToken


At every refresh, we also get a new refresh token. While the previous one is still valid (that's a weird MS choice for a public OAuth2 client), we should stop using it and store the new refresh token.

Docs: https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens#token-lifetime

We also need to update the auth.ExpiresAt

I had left this intentionally as a "feature" to enforce re-authentications more frequently, but I guess we can defer that functionality to the auth side. I've changed it to match your suggestion but if you'd like me to change it back let me know.

I see what you mean. Can we actually revert the change with the refresh token? Apologies for that!

Reasoning:

For public clients that are not single-page applications (SPAs), such as those utilizing the device authorization grant (device flow), the default refresh token lifetime is 90 days. This is already a lot for a public client but it's non-configurable.

Each time a refresh token is used to acquire a new access token, Microsoft Entra ID issues a new refresh token, that inherits the same default lifetime as the original. As long as the refresh token is used within its valid period, it is continuously renewed, potentially allowing indefinite access without requiring the user to re-authenticate.

Reverted back to not using the new RefreshToken

internal/auth/device_authorization.go

esarafianou · 2024-11-12T12:27:05Z

cmd/cloud/server_flag.go

+	command.Flags().StringSliceVar(&flags.RestrictedClientIDs, "restricted-client-ids", []string{}, "The list of restricted client IDs.")
+	command.Flags().StringSliceVar(&flags.RestrictedClientAllowedEndpointsList, "restricted-client-allowed-endpoints", []string{}, "The list of restricted endpoints.")


Aren't we currently having a fixed list of restricted client IDs and restricted endpoints that we can have as a default config?

How is this command usually run? I'd like to avoid the human error of someone missing adding all the needed client IDs and restricted endpoints here

This is run through IaC YAML manifests anywhere that the authentication would matter - see here we currently set allow-list-cidr-ranges and vpn-cidr ranges similarly to the way these would be set here, so I expect we should be ok from the human error side

model/client.go

internal/api/middleware.go

nickmisasi · 2024-11-14T14:39:03Z

Getting rate limited on a build step. Will try again later

esarafianou

2 last comments, looks great otherwise!

internal/auth/cli.go

model/client.go

gabrieljackson

Heya, have some initial feedback from my testing.

gabrieljackson · 2024-11-19T18:42:05Z

cmd/cloud/clicontext/clicontext.go

+	var contextsData Contexts
+	if _, statErr := os.Stat(contextFilePath); errors.Is(statErr, os.ErrNotExist) {
+		contextsData = bootstrapFirstContext()
+		WriteContexts(&contextsData)


We are ignoring the return error here and this seems to be hiding an issue where bootstrapping will fail on a completely new bootstrap. I believe the issue is the .cloud directory isn't being created.

Good catch! This directory is created when the provisioner is run so I never ran into it. Fixed

gabrieljackson · 2024-11-19T18:42:46Z

cmd/cloud/clicontext/clicontext.go

+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return nil, err
+	}
+
+	contextFilePath := filepath.Join(homeDir, ".cloud", "contexts.json")


Let's take this logic and put it into a reusable helper function to rule out any typos on the default context file path.

nickmisasi added 3 commits October 9, 2024 14:50

Draft: Add support for OIDC Authentication to the Provisioner

b82d156

Remove some commented code

fd3974c

Add todo

b806e96

mm-cloud-bot added the do-not-merge/release-note-label-needed label Oct 9, 2024

nickmisasi added 12 commits October 10, 2024 14:11

Fix linter

20d0cd8

Add OAuth Client Credentials handler to client

d4209d3

Refactor device_authorization for CLI

705c9a0

Add User ID from Context to logger

c113212

Remove random access log from testing

8bc5314

'Upgrade' version of k8s.io/client-go

10f644b

Logs

510fdad

Fix linteR

8ee306a

Add a support for configurable restricted clients with configurable a…

cb2dba9

…llow list for said clients

Remove Okta dependency in favour of generic JWT lib. Support for MS

e51cf29

Adjustments to allow for refresh token support with MS

7c27a30

Updates to client to pass custom scope

40e4dce

nickmisasi requested a review from gabrieljackson October 25, 2024 17:31

nickmisasi marked this pull request as ready for review October 25, 2024 17:31

nickmisasi added the 2: Dev Review Requires review by a developer label Oct 25, 2024

mm-cloud-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed labels Oct 25, 2024

nickmisasi requested a review from esarafianou October 25, 2024 17:32

nickmisasi commented Oct 25, 2024

View reviewed changes

nickmisasi changed the title ~~Draft: OIDC Authentication, and Cloud CLI Contexts~~ OIDC Authentication, and Cloud CLI Contexts Oct 28, 2024

Updates for client code

ff2f10b

nickmisasi mentioned this pull request Oct 28, 2024

Add support for OAuth with provisioner Client mattermost/mattermost-plugin-cloud#160

Open

esarafianou requested changes Nov 12, 2024

View reviewed changes

Changes for PR feedback

36f0195

nickmisasi requested a review from esarafianou November 14, 2024 14:17

esarafianou requested changes Nov 19, 2024

View reviewed changes

internal/auth/cli.go Outdated Show resolved Hide resolved

model/client.go Outdated Show resolved Hide resolved

Changes for PR feedback

8b0e747

nickmisasi requested a review from esarafianou November 19, 2024 15:11

esarafianou approved these changes Nov 19, 2024

View reviewed changes

gabrieljackson requested changes Nov 19, 2024

View reviewed changes

Fixes from PR feedback

11acb23

nickmisasi requested a review from gabrieljackson November 19, 2024 19:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OIDC Authentication, and Cloud CLI Contexts #1082

OIDC Authentication, and Cloud CLI Contexts #1082

nickmisasi commented Oct 9, 2024 •

edited

Loading

mm-cloud-bot commented Oct 9, 2024

nickmisasi Oct 25, 2024

esarafianou left a comment

esarafianou Nov 12, 2024

nickmisasi Nov 14, 2024

esarafianou Nov 18, 2024 •

edited

Loading

nickmisasi Nov 19, 2024

esarafianou Nov 12, 2024

nickmisasi Nov 12, 2024

nickmisasi commented Nov 14, 2024

esarafianou left a comment

gabrieljackson left a comment

gabrieljackson Nov 19, 2024

nickmisasi Nov 19, 2024

gabrieljackson Nov 19, 2024

		command.Flags().StringSliceVar(&flags.RestrictedClientIDs, "restricted-client-ids", []string{}, "The list of restricted client IDs.")
		command.Flags().StringSliceVar(&flags.RestrictedClientAllowedEndpointsList, "restricted-client-allowed-endpoints", []string{}, "The list of restricted endpoints.")

OIDC Authentication, and Cloud CLI Contexts #1082

Are you sure you want to change the base?

OIDC Authentication, and Cloud CLI Contexts #1082

Conversation

nickmisasi commented Oct 9, 2024 • edited Loading

Summary

OIDC Authentication.

CLI Contexts

Ticket Link

Release Note

mm-cloud-bot commented Oct 9, 2024

Choose a reason for hiding this comment

esarafianou left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

esarafianou Nov 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickmisasi commented Nov 14, 2024

esarafianou left a comment

Choose a reason for hiding this comment

gabrieljackson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickmisasi commented Oct 9, 2024 •

edited

Loading

esarafianou Nov 18, 2024 •

edited

Loading